Aztec Labs, the team building a privacy-first Layer 2 on Ethereum, has acquired Obsidion, the company behind the ZKPassport protocol and its accompanying privacy wallet. The deal brings ZKPassport’s developers and technology directly under Aztec’s roof, and the company has committed to keeping the protocol open-source.
What ZKPassport actually does
ZKPassport uses zero-knowledge proofs to let users verify their identity without revealing the underlying personal data. You can prove you’re a real human, or that you’re over 18, or that you hold a passport from a specific country, all without handing over the actual document.
ZKPassport enables selective disclosure. Users choose exactly which attributes to share while keeping everything else private. The protocol runs on both iOS and Android.
ZKPassport’s circuits and SDK are already live on GitHub under the Apache 2.0 license. The mobile application itself will be open-sourced after testing wraps up, according to the company.
Obsidion, the acquired company, also operates a privacy-oriented wallet called Obsidian. The outfit was built by Michael Elliot and Théo Madzou, both notable figures in the applied cryptography community.
Already baked into Aztec’s operations
ZKPassport is already operational inside Aztec’s ecosystem. The protocol has been deployed for Sybil resistance on Aztec’s testnet and served as the identity verification layer for Aztec’s recent token sale, which raised $59 million.
Why open-source matters here specifically
ZKPassport’s circuits and SDK are available under the Apache 2.0 license, which allows anyone to use, modify, and distribute the code, including for commercial purposes, without requiring derivative works to also be open-source. The mobile app will be open-sourced after testing rather than kept proprietary.
What this means for investors
Aztec now controls a vertically integrated stack: the Layer 2 network, the identity verification protocol, and the wallet. The $59 million token sale demonstrates real capital flowing toward privacy infrastructure on Ethereum.
The risk, as always with privacy tech, is regulatory. Zero-knowledge identity verification exists in a gray zone where regulators are still figuring out whether proving you’re human without revealing who you are satisfies compliance requirements.